Patent application number | Description | Published |
20100030891 | WEB-BASED TRACEBACK SYSTEM AND METHOD USING REVERSE CACHING PROXY - Provided are a web-based traceback system and method using reverse caching proxy, which can effectively protect a web server against various attacks launched by illegitimate user by acquiring network information and location information of users who attempt to access the web server through an anonymous server, without a requirement of installing any agent program in the users' clients. The web-based traceback system may include a reverse caching proxy server receiving a hypertext transfer protocol (HTTP) packet transmitted to a web server by a client, analyzing the header of the HTTP packet and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and a web tracking server generating a response page for the HTTP packet upon receiving the results of the determination performed by the reverse caching proxy server, inserting a tracking code in the response page, and providing the response page to the client through the reverse caching proxy server, wherein the tracking code is automatically executed in a web browser of the client and thus provides network information of the client to the web tracking server. | 02-04-2010 |
20100030892 | GIS BASED NETWORK INFORMATION MONITORING-SYSTEM - Disclosed is a GIS based network information monitoring system that intuitively combines GIS based geographic information with traffic information and a security event, expresses the combined geographic information on a display, and does not need position calibration of network information when the traffic information and the security event are expressed. The GIS based network information monitoring system includes: a geographic information processing module receiving network information from an external network device, containing GIS based geographic information, and creating geographic information corresponding to location information in response to the location information; and a network information processing module mapping the network information to geographic information corresponding to the location information to express the mapped network information, connecting an attack site of a packet causing a security problem, an intermediate site, and a target site using lines, and intuitively expressing the network information by varying the widths and colors of the lines according to the attack type and danger level of the packet. | 02-04-2010 |
20100067391 | APPARATUS AND METHOD FOR VISUALIZING NETWORK SITUATION USING SECURITY CUBE - An apparatus and method for visualizing a network condition related to a network security are provided. The apparatus includes a traffic feature extracting unit, a network condition displaying unit, and a traffic abnormal condition determining unit. The traffic feature extracting unit extracts information including source address, source port, destination address, and destination port from network traffics, selects two of the extracted information, and calculates unique dispersion degrees of two unselected information. The network condition displaying unit displays a two-dimensional cube expressed using the calculated unique dispersion degrees for the classified traffics. The traffic abnormal condition determining unit determines whether the traffics are in an abnormal condition or not based on the two-dimensional security cube. | 03-18-2010 |
20100100619 | METHOD AND APPARATUS FOR VISUALIZING NETWORK SECURITY STATE - There are provided a network security state visualization device and method, the device including: a security event collector collecting original security event information from network security apparatuses; a security event analyzer analyzing the original security event information collected by the security event collector and extracting characteristic data corresponding to a security event; and a three-dimensional visualization display unit visualizing a correlation between the characteristic data extracted by the security event analyzer as a three-dimensional screen to be displayed. | 04-22-2010 |
20100150008 | APPARATUS AND METHOD FOR DISPLAYING STATE OF NETWORK - There are provided a network state display apparatus and method capable of easily determining a present network security state in real time by analyzing an abnormality and harmful traffic deteriorating performance of a network in software by using a result of combining essential characteristics of traffic, a distinct dispersion, and an entropy and displaying the network state to be intuitionally recognized, the method including selecting and combining three of a source address, a source port, a destination address, and a destination port of collected traffic and calculating a distinct dispersion and an entropy of a residual one therefrom; displaying the calculated distinct dispersion and entropy on a security radar where the distinct dispersion and the entropy are assigned to an angle and a radius; determining whether a network state is abnormal, based on a result displayed on the security radar; and detecting reporting detailed information on abnormal traffic causing the abnormal network state. | 06-17-2010 |
20100162392 | APPARATUS AND METHOD FOR MONITORING SECURITY STATUS OF WIRELESS NETWORK - An apparatus for monitoring the security status of a wireless network is provided. The apparatus includes a radio frequency (RF) signal collection unit which collects at least one piece of RF signal information; a security event information collection unit which collects security event information including at least one of traffic information and alert information; a security event information mapping unit which maps the RF signal information and the security event information based on the correlation between the RF signal information and the security event information; and a security event information display unit which displays the result of the mapping performed by the security event information mapping unit. Therefore, it is possible to allow a network administrator to intuitively recognize the security status of a wireless network by collecting RF signal information and security event information from the wireless network, mapping the RF signal information and the security event information based on the correlation therebetween and displaying the result of the mapping. | 06-24-2010 |
20100169479 | Apparatus and method for extracting user information using client-based script - Provided are an apparatus and method for extracting user information using a client-based script in which user information including the internet protocol (IP) addresses of an attacking host and an anonymous proxy server used by the attacking host can be collected using a client-based script that can be automatically executed in the web browser of the attacking host. According to the apparatus and the method, it is possible to detect the location of an attacking host without alerting the attacking host by using a script that can be automatically executed in a web browser of the attacking host without any program installation. In addition, according to the apparatus and the method, it is possible to collect the IP addresses of an attacking host and an anonymous proxy server, if any, used by the attacking host by directly connecting the attacking host and a monitoring server. | 07-01-2010 |
20100212013 | LOG-BASED TRACEBACK SYSTEM AND METHOD USING CENTROID DECOMPOSITION TECHNIQUE - There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack. | 08-19-2010 |
20110016208 | APPARATUS AND METHOD FOR SAMPLING SECURITY EVENT BASED ON CONTENTS OF THE SECURITY EVENT - There are provided an apparatus and method for sampling a security event based on contents of the security event, the apparatus including: a security event accumulation module collecting security events occurring in a network system and storing the security events for each type according to contents of the security event; a security event analysis module calculating distribution of the security events for each type by analyzing the stored security events; and a security event extraction module sampling the stored security events according to the calculated distribution of the security events for each type. The apparatus and method may improve speed of visualization of a security event and a security event analysis apparatus and may increase accuracy thereof. | 01-20-2011 |
20110016525 | APPARATUS AND METHOD FOR DETECTING NETWORK ATTACK BASED ON VISUAL DATA ANALYSIS - An apparatus for detecting a network attack includes a traffic image generator for generating a traffic image using traffic information and additional IP information extracted from the traffic information; a network attack detector for comparing similarities between the traffic image and a previously generated traffic image based on a predetermined similarity threshold to detect the presence of the network attack; and a network attack analyzer for analyzing the traffic image at a time when the network attack is detected to detect network attack information and pattern information of the network attack. A representation unit for visualizing the network attack information and the pattern information of the network attack. | 01-20-2011 |
20110047623 | APPARATUS AND METHOD FOR TRACING WEB USER USING SIGNED CODE - Provided are an apparatus and method for tracing web user using signed code. The apparatus for tracing web user includes at least one access terminal, a web server, and a monitoring server. The at least one access terminal requests a web page. The web server provides the web page including a signed code to the each access terminal according to the request. The monitoring server receives and analyzes access information which is extracted from the each access terminal according to execution of the signed code. | 02-24-2011 |
20110122132 | APPARATUS AND METHOD OF MANAGING OBJECTS AND EVENTS WITH VECTOR-BASED GEOGRAPHIC INFORMATION SYSTEM - Provided are an apparatus and method of managing objects and events for easily enabling intuitive management and the recognition of cases in linkage with geographic information. The apparatus links objects and events to geographic information with a vector-based GIS to display them on a vector-based digital map, thereby providing an intuitive and realistic interface to a manager. Accordingly, the apparatus can display a more accurate location than an image-based map, and can select a kind of map information that is desired by a user to configure a map screen. | 05-26-2011 |
20120090027 | APPARATUS AND METHOD FOR DETECTING ABNORMAL HOST BASED ON SESSION MONITORING - An apparatus for detecting an abnormal host based on session monitoring includes: a host information collection unit for collecting information of processes being executed in hosts and information of sessions connected by the hosts; a network traffic monitoring unit for collecting network traffic information; an analysis unit for calculating an entropy of each host based on the collected session information to analyze correlation between hosts based on the calculated entropy and the network traffic information; and a detection unit for detecting an abnormal host and a process causing harmful traffic in the abnormal host based on the correlation and updating a black list based on the detected host and process. | 04-12-2012 |
20120096150 | METHOD AND SYSTEM FOR PROVIDING NETWORK MONITORING, SECURITY EVENT COLLECTION APPARATUS AND SERVICE ABNORMALITY DETECTION APPARATUS FOR NETWORK MONITORING - A network monitoring system includes: a traffic information generating apparatus for generating traffic information. Further, the network monitoring system includes a security event collecting apparatus for collecting the traffic information generated by the traffic information generating apparatus by referring to pre-stored traffic information, grouping the collected traffic information, and then extracting service information. Furthermore, the network monitoring system includes a service abnormal condition detecting apparatus for detecting a port number of a transport layer of service information extracted from the security event collecting apparatus and the occurrence frequency of the transport layer, determining the continuity of the port number and the uniformity of the occurrence frequency, and displaying a service abnormal condition. | 04-19-2012 |
20120117034 | CONTEXT-AWARE APPARATUS AND METHOD - Disclosed herein is a context-aware apparatus and method. The context-aware apparatus includes a microblog monitoring unit, a web information collection unit, a microblog information collection unit, and a context-aware information creation unit. The microblog monitoring unit monitors the written information of one or more microblogs, and extracts at least one keyword corresponding to a set topic from the written information. The web information collection unit collects web information corresponding to the keyword from webpages. The microblog information collection unit collects microblog information corresponding to the written information including the keyword from the microblogs. The context-aware information creation unit creates context-aware information using the web information and the microblog information. | 05-10-2012 |
20120147179 | METHOD AND SYSTEM FOR PROVIDING INTELLIGENT ACCESS MONITORING, INTELLIGENT ACCESS MONITORING APPARATUS - A system for intelligent access monitoring includes: an access control apparatus for detecting and managing an access of a visitor, the access control apparatus generating a access event information when detecting the access; a video security apparatus for managing an video information and a location information of the visitor; and an access monitoring apparatus for receiving the access event information, the video information and the location information via a network, generating a access monitoring profile information based on the access event information, and generating a mapping information where the access monitoring profile information is mapped with the video information and the location information. | 06-14-2012 |
20120151581 | METHOD AND SYSTEM FOR INFORMATION PROPERTY MANAGEMENT - A system for managing sensitive information property, includes a monitoring agent installed in a host system needed for sensitive information property management and configured to monitor the sensitive information property; an information property storage configured to store a list of the sensitive information property for the host system; and an information property manager configured to determine whether or not the sensitive property has leaked. | 06-14-2012 |
20120159650 | APPARATUS AND METHOD FOR RECOGNIZING SECURITY SITUATION AND GENERATING SITUATION INFORMATION BASED ON SPATIAL LINKAGE OF PHYSICAL AND IT SECURITY - An apparatus for recognizing security situation and generating situation information based on spatial linkage of physical and IT security, the apparatus includes: a security event collection unit for mapping, when a security event is detected from a security device, unique information of the security device to a location or an object in a real space, and collecting correlated security events based on the mapped information; a security situation awareness unit for determining a type of a security situation and a degree of threat based on the correlated security events; and a situation information generation unit for analyzing a correlation between the correlated security events and the security event to generate security situation information. | 06-21-2012 |
20120240231 | APPARATUS AND METHOD FOR DETECTING MALICIOUS CODE, MALICIOUS CODE VISUALIZATION DEVICE AND MALICIOUS CODE DETERMINATION DEVICE - An apparatus for detecting a malicious code includes: a malicious code visualization device for generating a graph for a malicious file by using strings in the malicious file, a connection among the strings and entropies for the strings and establishing a malicious code database with the generated graph for the malicious file. The apparatus further includes a malicious code determination device for generating a graph for a specific executable file and comparing the graph for the executable file with graphs for malicious files stored in the malicious code database to detect a malicious code in the executable file. | 09-20-2012 |
20130335415 | CONVERGED SECURITY MANAGEMENT SYSTEM AND METHOD - A converged security management system includes a geographical information optimization converter for converting pieces of geographical information collected for converged security management into a data format for high-speed rendering; a three-dimensional (3D) object model generator for generating security facilities that are a subject of the converged security management in a 3D object model like a real object; and a 3D realistic user interface for displaying the security facilities that are the subject of the converged security management using the pieces of geographical information and the 3D object model in a 3D object, receiving an security event from a physical or Information Technology (IT) security sensor, mapping the security event to the 3D object, and displaying a security situation. | 12-19-2013 |